16624 - textareas garble newline character entities

Status: VERIFIED FIXED

(Core :: DOM: HTML Parser, defect, P3)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

DESCRIPTION:  This problem occurs on bookmarked bug-sumbission forms in
Bugzilla.  Marking as major.

Textarea's have serious problems with the character entity pair 
 in
their initial value.  For backwards compatibility (and it's also sensible, and
possibly required by some spec), this should be treated just like it were part
of the text and there were an "\r\n" in the text.

STEPS TO REPRODUCE:
 * Load attached test case.  The page contains two text areas.  The first uses
entities in the default text, the second uses newlines.

ACTUAL RESULTS:
 * The first textarea is garbled.  Each line is repeated once, but the line with
two blank lines after it is repeated three times.

EXPECTED RESULTS:
 * The two textareas should be identical.

DOES NOT WORK CORRECTLY ON:
 * Linux, apprunner, 1999-10-16-08-M11

WORKS CORRECTLY ON:
 * NN 4.x

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: test case described in bug

Comment 2

[karnaze (gone)]

Reassigning to Steve.

Comment 3

[Sean Richardson]

Attachment: Same test case with FORM element around textareas

Comment 4

[Sean Richardson]

On Windows NT, both 1999-10-15-11-M11 and 1999-10-17-09-M11 crash on viewing
both the original testcase and the revised testcase that puts the TEXTAREAS
is a FORM. The borders of the textareas get drawn, but no text appears in
either, for both testcases, and then CRASH.

Also, on Windows NT, NN 4.7 displays the text in the original testcase as
if it were not in textarea elements. The revised testcase fixes that by
putting the textareas inside a FORM.

Speculated that this was also the cause of the Mozilla crash, but since
it crashed with the revised testcase too, that can't be the cause.

Comment 5

[buster]

assigned to rickg.  we looked at it together and it looks like the parser is
misbehaving.

Comment 6

[rickg]

Fixed by truncating buffer which was used to tranlate entities.

Comment 7

[cpratt]

Looks fine on both Win32 and Linux, 199910190x builds.